Kubernetes Ingress Nginx Subproject, 13 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: [SIG-Network] Ingress NGINX Bi-Weekly Meeting for 20221013

Description

[SIG-Network] Ingress NGINX Bi-Weekly Meeting for 20221013

A

Hello: everyone, it's October, 13th, it's James strong. This is the Sig Ingress nginx sub project meeting facing networking, which means it is subject to the cncf code of conduct, which remains be kind to everyone. If you have any issues, please report those to myself or cardo or the Sig networking leads or the cncf themselves.

A

So with that we'll go ahead and get started as I was saying at the beginning of the meeting before we start, recording was not prepared for this, so I don't have a list of things for us to go through from action items. We can go back and look at what we need to discuss. We've got a couple things for kubecon that we probably want to discuss with the community.

A

We started looking at that got some of the server results back, but um I think the big thing we want to make sure that we do the issue triaging, because I noticed there was a lot of discussion and the 100 or so responses about issue challenging. So I want to make sure that we do do that before we jump into the project stabilization and um the big success that Ricardo's had over the past week or so so.

A

um I'm gonna go ahead and um we can jump in the issue. Triaging um I think everyone here is uh introduced themselves, but if you are new- and you want to introduce yourselves what you're talking about with the project or if there's anything that we need to discuss, go ahead and drop those in the chat, so we can pull those up when we get to them.

A

um Anybody have any open topics we need to discuss or want to introduce themselves.

B

Someone is new here, oh.

C

Hi, um can you hear me.

B

C

Hi, so uh my name is Joel I'm 20 years old, I'm Brazilian as well, uh well, I've been using kubernetes for for a while, now and I'm trying to get into it. I'm trying to contribute a little more so just here to as a listener want to learn something new, so I hope you guys will see me uh the next in the future too. So thank you and well Ricardo I.

D

Thought he was.

E

D

E

I thought he was your student.

B

Yeah he's not, but he's he's it's amazing having more Brazilians here we can start speaking in Portuguese and we don't care about you folks. You you now need to learn Portuguese instead of us speaking, English I, don't care.

A

B

uh I'm sorry welcome.

B

uh I will bring Carlos and amim to this meeting as well. Then we are going to be the majority here. Yeah.

A

um It was it Roe. Is that how you pronounce it.

C

D

A

C

To call me John, don't worry no.

A

No I want to make sure we get it right, Joe Joe, all right! Thank you for joining. That's awesome! um If you have any questions about issues or things like that or how we proceed through things um feel free to hit us up in the Ingress dub slack. So thank you for joining uh with that. We will start the uh the triaging of issues as soon as I can find the uh share button.

A

It's like I've, never used slack or technology before.

B

Even because this is zoom and not Slack, I know you are so you are looking on the wrong place, probably yeah.

A

I've got I've, got 48 inches of screen and I've got too many tabs open, I.

B

Know you I know the pain.

A

All righty: let's go ahead and get started. 1109 I just want to keep us keep track of the time alrighty. So as always, we want to start looking at the needs, triage and priority issues. So let's go ahead and jump into them. Is there any that anyone knows about that? We should look at before. We just go through the list.

E

um Ricardo mentioned about uh the default backend and it was iffy until a little while ago, but one or two issues have come in so looks like we should look at it and replace and and make sure that it's our own image. That means so background is that if we enable default backend it, it uses an image, that's on GCR, but that we don't maintain and it's like real old.

E

So first problem, somebody reported to us it's offering one TLS 1.1 and it should not be and now just now somebody else is reporting that it's also exposing three endpoints.

D

E

D

Talking about this one.

E

91.55, that's one and there's one more.

B

Yeah yeah this is this is one that was uh really good, that someone took on on slack actually, uh because we use an image that we don't maintain and no one else maintains as well right. So uh uh it's gonna be probably a really good first issue, at least to assemble this as a small engine, X container or something, or even like a python, a python container just running like part 8080 with a default back-end or something like that.

B

uh But we need to have something that's built from our images and not using this one anymore, because it's not maintaining I.

E

B

Can we can we can accept this one, but is there another issue long or this is the one- that's mapping everything I think this.

E

Is this one is a new one, but the other one which you recommended and somebody and here there's a PR which is coming. If you go to PR's that PR came in just a little while ago, where.

B

Who requests pull.

A

Requests I was just looking at the images. I didn't realize that we didn't.

B

Did I I was sure that this image was ours? Actually I was like okay, this is ours, and this this person actually came to see network or CKC infra asking and then I I directed this person like hey. Can you go to our slack Channel, because this is ours and then I realized that this is actually not ours, but uh yeah.

A

So you said: if somebody's already got a PR to fix it.

B

I didn't solve PR, okay,.

A

B

Last one: okay.

D

um Yeah, that's.

A

uh That's an issue so do we just wanna I mean the short put is to just pull that image in and maintain it like we do with our other images.

A

Do we want to do that, or do we not want to keep replicating.

B

So this image is actually something from Google is GCE right. So that's their call. There is a repo, but they are not building automatically anymore. Oh.

A

B

So I think that we should I, don't think we should Fork because they have like they are using like a gold program that answers HTTP, whatever I think we can just have some simple, really simple, HTTP server that can be the default back-end right. Otherwise, it's just going to be another image with CVS blah blah whatever so.

D

E

Ricardo there is two issues right: one is that when there is no match for the hostname in the incoming request, only then it comes here to default. Back-End right.

B

No I'm right now, I'm just thinking of the problem on the default back in the image. I, don't know. What's the host one right now or if I commented I can't remember, can I send those what.

E

Yeah I'll try to get this like, so the problem the guy he's talking about is that, first and foremost he wants. He is talking about hand tackling the DNS response from default back end.

B

Okay, hold on you, you're, taking me on slack and I'm I'm I'm I'm, not gonna, say that I've been two activities like other than just sending you messages about how many tests failure is I'm getting. So let me see.

E

I'm taking the trend, sorry.

D

B

No problem I just keep missing those.

D

B

This is this something with the helm chart one can you can you tag me again? Please.

E

Yeah yeah I'll.

E

I'm trying to get to that.

B

Yeah, okay, because because I mean I would like at least to separate, if, if those are like different problems, one is just maintaining the default back end image and the other one. It's like the way that we pass holes or whatever to the default back-end a pod I think those are two different problems that we need to deal with them differently. Right.

A

Yeah, okay, well, I've accepted this one. um Let's.

B

Yeah, let's, let's move it, let me again: I will take a look into that.

D

B

Please, thank you, man, okay,.

A

um Joe, if you wanna, set up some time, I can walk you through this one on how we do images and things like that, and um we could help replace the images and I think this I agree with Hikaru. I think this would be a good first one.

B

Is actually on the top of the goal view chat if I record correctly right? Oh.

A

D

C

It's me: well, okay, uh I think we can do this. Asynchronously I'll call you later. Okay,.

D

Okay sounds good. Thank.

C

D

Awesome, that's not what I wanted to look at.

A

Ingress generate wrong location if you use a regex, what's the old adage, if you have a problem that can be solve, diuretic rejects, you have two problems now.

B

If you are using rejects, you are wrong.

D

A

We support it, so let's go ahead and look ninja.

B

Yeah no just kidding yeah.

A

I know uh contains wrong location when I use a regex path without the tilde modifier. What's.

D

D

B

The path generates that thing.

D

B

Okay, okay, uh I'm, not sure this is if this worked before on some previous releases.

B

But uh so if it worked it's a bug, if it didn't work it it's a feature right.

B

Do you remember if this worked before someone already tried this before.

A

Yeah I, don't I, don't I, don't remember this one at all.

B

Yeah, let's accept this, one I think it's accepted and uh let's say that: let's ask some more information like hey. Can you test some like? Did this work it before for you or not right, because yeah I think it's something related with what you.

A

Think it's a regression.

B

Yeah, maybe I don't think it is, but I I, don't remember any of us messing with the regex annotations, but uh there's.

E

A guy called Singh Henry from Singapore who, who put in a fix for, uh is a related issue where, if you don't use a host name or if you, if you put two or if you use, rejects or if you put two, if you used to annotations together without hosting anything like that, it it messes with the location.

E

So we'll have to look it up. So.

B

So it is something it is a bug or not.

B

Oh hold on hold on hold on.

A

I just thought: yeah I was looking for the version and there it is that's that's engine. Okay, that's an engine, X open source, so uh we'll pass that off to Dylan.

B

Where's Cairo a Dylan is here.

D

But that's Dylan.

F

D

Me pull that now you are muted yeah.

F

I'm unmuted now sorry I was yeah. This is weird.

F

A

It that's very weird because you look at this. It says it's he's trying he's using our bare metal installer, but the version.

B

And he's using something for yeah, even like the Arts, the artist he's using engine.

E

B

B

Something it's not it's not and yeah.

A

Yeah there's something very wrong here because he's he says he's using the nginx stable, but when we go into the outputs and things he's using our hell, our bare metal deployment I have no idea. What's going on here, but um or.

B

Is he saying that on the enjoy next one it works in an hour's? Not can can we check if this is something.

D

What I expect Gen.

B

X Ingress controller version, blah blah blah whatever I'm using yeah. It's it's it's wrong and.

A

Then he says yes, it's here, there's using stable um yeah, there's some confusion, yeah confusion in here. um Let me, uh but this I'll take the action item to write this out.

A

You guys don't have to sit and uh watch me uh type out a response.

B

A

Okay, don't want to waste our precious time. Sticky sessions extend the time until a cookie expires on every request. That's a feature request. We need a tag for the feature requests. While we are we're always still not accepting them. Do we have one I, don't think we ever introduced. One.

B

Life cycle, Frozen, Maybe.

A

E

uh Hey James, um hello, the 9152 issue 9152 and was issue about TLS I think they are both related or need to be worked on together.

E

Because they're both solving the same problem, vulnerability.

D

E

So Ricardo I think the chat was with Wow on DNS and but there's also 9152 he's talking about three end points being exposed from default backend, which will ultimately end up being customer Pages image.

D

B

D

B

Need to track yeah, and maybe we should use the Keystone measure for everything as it's. uh It already does almost all of the things and contains the same problems right. What.

A

Was the other one.

E

9152 and uh the walls uh 9155.

A

Oh, this is the default back-end. So, okay, you think they're related.

E

Yeah so default back-end. We can't use the current image that is configured in value sample. We have to switch to custom error, Pages image and if we do, uh if what I mean when we do, there is three 10 points on customer pages that need to be disabled.

D

E

So, who always here I think he can comment you can do take care of both.

C

uh Well, I'm not sure honestly, I'm I already assigned the Gold Room check and there is the leap year, one too that I'm willing to start so.

A

um But yeah I'll I'll add this one: I'll I'll add it to the acceptance. I'll accept the triage and um we can look at it.

E

Regardless of seeing that right.

D

E

Dump that image that's currently configured in value server and we config- and we just fix custom error pages to not have these three okay and also removed uh deprecated TLS protocols. We.

B

Can we can do all of all of those in TC? Imagine maybe use custom measure as the default back end as well. Yeah yeah.

E

B

Sounds good okay,.

D

E

But later on, I think offline is not waste time now, but often we should continue to comment on why okay, I'll I'll talk to you offline. Why should why? Should? How can you give TLS response from default? Backend is a confusion.

B

How how what's wrong sorry.

E

Default back end is routed to when there is a mismatch or there's no match for any rule. Yeah.

D

E

Neural matches right then. How do you give a TRS response? You can't possibly match all fqda's possible fqda that somebody in like Brazilians possible rights. How do you give TLS response there.

B

um I I, don't think I'm following.

A

B

It's not gonna.

A

Match on the default back end, so if there's not a if the, if the host doesn't match anywhere, it's going.

B

A

B

No, no, no, no! So the default back end it's so. You have the the front and virtual holes right and then you say my default back end. It's just this one! uh So you pass the host header to the default back-end and then the default backend can or cannot be configured to to answer based on the on the host header right.

E

D

E

That the host header can be anything like. We can't have a certificate there, so it.

B

Will always be fair yeah, so so so you pass actually no no, no, no hold on I think we are going too far here. But uh let's, let's, let's try to discuss that. Let let's try to discuss this in offline because the problem with the default back end- it's just like you- can have anything as soon as it understands the ex for what did uh headers right so DX forward. Maybe.

E

B

The host and whatever we can keep it simple in our case and say: hey our default back end is just going to answer like okay or not. Okay, not found something like that, and in the future we can even create a demonstration on how using the default back-end with something different like the default back and it's gonna answer like uh this whole slash paths wasn't found right.

E

So we can just responses over over HTTP right. Not it's not they're, not there. It's not a dearest response right.

B

uh Yeah, maybe okay, maybe maybe the the response that we are missing there. uh It's like the front end is answering with TLS I. Think I need to I need to stop and understand that better yeah.

E

B

E

Now, let's talk about because issue and what is talking about is TLS in that response. Okay,.

A

Let's, uh let's look at this one: this will be our last one, but um I know that we've had performance test issues before we've got the memory issue and I know: we've got the performance testing. So, let's see if this is a see, if they're doing anything out of the ordinary, uh so we'll we can skip all the timeouts and everything I didn't do a great job of formatting yeah. We still.

E

Have some information on this? It's it's still. We still tend to gather information.

A

Yeah I guess also. There is an information on the size of the cluster and things like that. Oh there, it is.

A

We've been seeing a lot of cloud issues, I mean I, know: we've got a lot of AWS and AKs issues.

A

At least I I've been feeling that I don't know. If anyone else agrees.

E

And the recent gcp issue about the port, zero.

A

Yeah I can't even I I won't even begin to know where to look for the gcp stuff.

E

Yeah, if you see a trend what's happening, is people uh not trying to use a magnet static, manifest for cloud they're trying to use the help chart and then try to use values, file for respective annotations and um other configuration that needs to go in for the cloud for their specific Cloud.

A

I'm, seeing four or fours and 200. I'm, seeing four fours and 508s in here I'm, not seeing.

A

These look like issues with their back ends and not within genetics.

A

If I'm reading this right.

E

Okay, so you basically complain that it's restarting.

A

Because that's it that's 200! There.

A

There's a 404 there.

A

And you're gonna need a little bit more information, also about how he's got his load balancer configured as well and I. Would it would be interesting to see these tests inside the cluster, so we can completely remove Ingress um I.

D

A

That might be something worthwhile.

A

D

You I think we.

A

Just need to add a little bit more from a troubleshooting perspective on like testing things on single nodes.

A

I think we need to add a little bit more of just like how to do the troubleshooting make sure your services are up and running and then move out from there to the cluster and trying to isolate where the actual issue is because just dumping error logs out here like this, that's not helping anyone.

E

But in this context, she's talking about restarts so it could be restarting because he doesn't have enough computer on the nodes he's talking about restarts.

A

Well, there's also: no, we need some memory stats here then too,.

A

A

I will take the.

A

I'll add my response.

A

To those two, so I've got two to respond to because I wanna I know. We've got a couple of people on the call that probably want to talk about what they've been working on. So we can discuss those um and I've noticed too just in general. The troubleshooting Pages aren't really helpful, because we've got a whole debug tool that we place in there and there's no I've not seen any notes on how to use that thing.

A

A

Well, we were just getting ready to go talk to you Ricardo, so who wants to talk first? We want.

D

A

About the go vulnerability scanning the defense, split or open Telemetry I.

B

Can I can I can I can go really fast. Sorry, I I was writing that because I I wasn't paying attention to the issues unless someone else when I thought can I. Yes, no, maybe okay cool, so uh cpdp split uh I've been fixing the fasts I've been fixing some things. I've been founding the end-to-end test. They are actually finding some real bugs as well. So um right now uh we have just 40 tests, failing which is amazing, because we had 80 on Sunday um 120.

B

uh Last week, my plan uh my plan, it's for between, because I am kind of on vacation today until Monday. My plan is it's to see if I can fix at least more 50 of the tests and then uh doing some real uh closing some some real things like hey. Now we have end-to-end tests. We know that Daniel that the test they are working and we need to figure out how to solve now the other things like load, balancing recognizing reconnection between control, plane and data planes. Even writing.

B

Some end-to-end tests on that uh scalability, adding compression testing testing the scalability of of the split and so on. uh Jintao made some reviews. I didn't solve the reviews, yet I told him because I'm trying, first of all to have the end-to-end tests working and then I will really I promise you until I'm, not ignoring you.

B

I will take a look into all of the reviews and even I will do myself some reviews as well, because I know that I left a bunch of uh debugging things like printf I'm, here, klog, dot, warning now I'm here and so on, like the the the the correct way of debugging things right uh yeah. So that's uh that's all from my side. I I hope that until Tuesday I have some more things to to deal with to to to fix fix it.

B

Actually, then, we can kind of sit down during kubecon after that before that and even next week, and and have some where we are and how much time we need more to to fix this, uh it's gonna make it easier for, for all of the other things so far, I'm pretty happy with all how this is going because I know that, like for the open Telemetry side, it's going to be easier to implement this on on the con.

B

On the data plane now being plugable, I know that it's going to be easier for us to start doing the cleanup of the code on the things that we know that we can remove and so on. By the way uh we have that survey and I think that in some time we would need to put on vault or discuss on the deprecation of things that we've been thinking on. Deprecating I'm, not sure if we should do that after or before coupon right, but I think we should do that.

B

A

Right thanks Ricardo, thanks for all your hard work on that uh how's open twenty gone.

D

um That should be complete I'm. Just looking for the review from from you guys, my.

B

Bad sorry, it's not it's not again! It's not that I'm, ignoring it's just like I'm, really trying to focus on on this split control, clean and data plane, but uh I would maybe differ to Jin Tao. If you can do some review on that, and we can do a release on the open, Telemetry thing even before the split control, plane and data plane. I think it's gonna be fine for us to know how this is going to work.

D

And the pr is 9062 9062. Thank you.

E

Only one or two is one.

D

For taxation I tried to make it too small, so just to help with the review.

D

A

Fine record: okay.

D

Awesome yeah I've made also an example that, if you go there's some documentation in comments.

A

One three hours was never accepted.

E

I told Ricardo once jintado located and you oh okay,.

A

uh I didn't want to add more of the Gentiles, because I would like to this good open topic to move to how's our open Rusty upgrade going towel.

D

A

Didn't mean to put you on the spot right there.

B

It's it's almost midnight for Jintao James. Take it easy.

E

Yeah half past 12 in the night yeah.

B

The question yeah.

B

Okay, I think this one is moving right.

B

E

Yeah he said he's working on it: okay,.

D

Yeah I'm I'm, so so busy.

B

A

uh Yeah I just want to make sure like if there's Ingress work. You're doing this is probably the top priority so ignore everybody else.

E

C

E

C

E

The last leaves at night.

E

He's awake at two in the night and four in the night and six in the morning.

A

Okay, I'll I'll leave it to you to you Gentile.

A

Okay, um Zhao, did you see?

A

uh Did you see the latest uh comment that I put on the go vulnerability, um so it was two I think either just a summary on the GitHub action is fine, but as I was thinking about it more, when we do the vulnerability scans, we also dropped them as a serif report in the go in the GitHub security tooling, which is unfortunately only available to the maintainers, probably because of the sensitivity of what's in those so I'm kind of I'm stricken between those two, because right now, the if we find any of the vulnerabilities and the scans I think the scans vulnerability scans are like trivia and gripe are in the GitHub summary action and then the code, uh the code at the coql that all gets uploaded as a serif reports to GitHub security.

A

So uh either way is fine by me. um I, don't know anybody else have any opinion on where those results should go.

D

E

It should be actionable if vulnerability is found, it should be actionable any which way is fine.

C

uh Honestly um I didn't know about this. Your whole check. Actually uh you just comment: uh I'll take a look uh I'm, not that sure. If I like it, the job summary because honestly I I, don't know how frequently we will look there and uh how fast these reports will come. So uh I did take a look at. How can we do it, but I'm not too sure if it's if it would be a a good presentation of the results you know uh about this sorry.

A

I I agree because I think the the summaries don't alert people on um issues because we don't have any other any things that connect like GitHub action, output or failures like do we want to fail, I, don't know if we want to fail if those vulnerabilities found, because that's really the only way you get alerted. If actions fail um report to GitHub security.

C

Yeah I'm not familiar with that, but I I'll take a look at. Maybe we can discuss later in this late because I don't know about service reports and stuff. So not too sure. If I can't comment about that right now, uh I thought about uh maybe commenting the pr like which vulnerability were vulnerabilities were found. If any, but still um I, don't know. If Comics you need an unrelated VR about some vulnerabilities actually uh help at all so yeah I'll.

D

C

I think we can discuss later I.

D

A

An open, if you can open an issue that probably would be helpful, just opening an issue if a vulnerability is found and then once we do triaging it pops up. It comes up.

C

Yeah uh would help the the only problem with this approach. Is that I'm not too sure how we can manage those issues to not be repeated? You know only using the action, so I don't know. If two PR is fine, the same vulnerability. How can we make sure not to report it uh more than once you know, so we span a lot of visuals in the in the project, so yeah I don't know about that.

A

Right that would be yeah. You don't want to do that. Okay, we'll we'll keep working on that. Thank you for that. uh For that help, um James.

E

So we need to get quick comment from Ricardo on 9157 because that's potentially, for we don't know if that's existing vulnerability or not.

A

9157, oh this one, this one.

E

Yeah so regard to do is this this one? This.

D

B

D

E

B

But this is this: is in China Express this. This is not ours.

D

A

This is the one that's really weird long, but it looks like they're they. They comment on both uh the the bare metal deployment for us, but they also say they're using the nginx stable Helm chart. So it's very confusing I was going to follow up with this one offline.

E

A

E

Have this vulnerability, not not necessarily right and by default, do we are we having a 60 second.

A

I, don't think we're talking about the same one, because this is a vulnerability. This is just an issue. You said 9157.

A

um Yes, the Ingress generating the wrong location. If you use regex, oh.

E

Wait? No! No! No! No! No! No! No! Wait! It's not 9157! So.

B

It's about a header.

E

E

D

Sorry, nine one.

E

You know: okay, I'll.

A

I'll drop, it drop it and Dev. If we don't get a chance to get to it,.

F

Is it 9146?

F

Is that the one you're looking for.

E

I'm ticking so he's basically saying um they say header that is yeah. Sorry about that yeah 9146! Thank you yep, so Ricardo, nine one. Four six is saying that the default timeout or something is 60 seconds and all that and that allows for a attack, slow loris does.

A

So he's asking for he's asking to be able to set that without server Snippets.

E

D

A

I'm back here, sorry folks, if we want to change the Ingress object that the API changes, that's not something we can control because he's saying he wants to update it on individual Ingress objects. We.

E

Yeah regard to that question: for you do we have this vulnerability.

A

I wouldn't say: there's a vulnerability.

B

This link you sent hold on I'm reading.

D

9146 clients had their timeout.

A

I agree with you tell that this does sound valuable to be able to update it, but the way there's only two ways to update things right in the the config map or in annotations. We can't change. Ingress objects, other ways unless it's in the API already.

D

B

I think I think it's uh I think it it can work actually, if, if it's it's just like like a parameter that can be configured right, so the idea of protecting to slow law is it's uh it's? Okay.

B

Maybe this should be a a global thing as well, because uh you can, if someone configures this annotation, a specific Ingress with a value too big, maybe can fall into the slow law, is for the whole engine X anyway right. So you have shared virtual hosts and then I configure my my client header for five seconds and then James puts like three minutes or three hours. Someone that figures out can just abuse, James virtual host and keep opening connections and and it's engine X doesn't deal on that in a silver way right.

B

So uh maybe we should have something like a client header timeout for each annotation, each Ingress and then a global configuration that an admin can say hey. This is the maximum of client hitter timeout. Someone may have make sense.

A

So we want to add a specific annotation for client ahead or timeout, but we also want a client header, Global timeout, and if the global is lower, we want to make sure that that one takes.

B

Precedence we can have, we can have something like a default, a configurable in a globe on a maximum Global right, so the default, it's the one that we are going to apply for everyone like 10 seconds now. Imagine that you have something that's slower on the back end for the header, timeout and- and you don't want to create a new Ingress controller just for that. It's a bad situation, but I've seen happening a lot yeah right. So you may want that specific Ingress to increase the client heater timeout for that right.

B

But you may want that person not to be able to pass like hey my client here timeout is going to be five hours, so the maximum that these the Ingress administrator added for this. It's like 10 seconds or 15 seconds, but this is something that would be to need to be discussed. Better I mean it's as Gentiles said. It's valuable I! Just! Don't think that this simplistic implementation is going to have help, or it's just going to add a worse vulnerability on like someone with access to create a new Ingress control, a new Ingress object.

B

It's just gonna, put like a huge value. I know that that huge value can be used as far as low Loris attack.

A

Agreed: okay, so.

E

A

Triage accepted and put it on the backlog.

E

um But Ricardo either 60 coming from us or is it 60 implied by Upstream nginx.

B

What sorry, what's.

E

The difference the 60 seconds is uh implied by.

B

There is, there is a default on that right, which.

E

B

E

B

We can we can allow someone to configure the default like saying hey. This comes from from in China X, but did they follow in the config map is like 15 seconds right. So all of the objects. They are gonna win 50 seconds. But if you need something bigger than 50 seconds, you can configure in your own Ingress object as soon as it doesn't surpass the maximum value Allowed by the Admin right.

E

Itself right and the question was the maximum allowed: will that be 60 or can it go beyond 16.? We can't define something by ourselves right.

A

That's that's the idea that we're discussing it's like, should we and impose that maximum.

E

Okay, because what I was trying to get to was, if we mess with this, then will it impact the websockets or anything anything of that nature.

B

I said: I think this is not for the websockets. Actually, no, uh the websocket, it's a different timeout.

D

B

uh It's the com, it's the kpli five out. Actually it's the time that that communication keeps open until someone says: okay, you are open for too much time without any communication right, because the idea of the website, the websocket it's going to be something reactive, yeah, you always open, and you expecting that streaming, someone pushing something and sometimes that streaming just gets closed by timeout or because it doesn't get any any new bytes in the middle of that right. I think this one is it's: it's different.

B

I never saw a client header need to be bigger than like 10 seconds right, because it's like you sending you opening the communication and saying hey in China X. It's me, and this is what I want so between the it's me, and this is what I want. You cannot send anything and just keep just keep feeling the communicate the the the channels of the Ninja next right. So solar is it's it's based on that a new kind of Dos. You are in gynex because you just feel all of the available connections.

B

With things saying: hey, I, wait a minute! I'm gonna send my my things: hey wait a minute. I'm gonna send my things and you'll never send so you keep that Communications busy right. So that's that's a different case in this case. Okay,.

D

D

A

I accepted it anyway, but we somebody's gonna have to get assigned to it and we'll have to prioritize it. But um as of right now, that's we're all pretty much maxed out. um Okay, probably won't put life cycle Frozen on that one as well we're about at time or is there anything we need to discuss. I. Think everybody's got something that they're assigned to.

F

So I can give a quick update on the agent progress. um I wish it was better news, but um we they restructured the team and it's been reassigned to a um I. Don't know if you guys are familiar with Liam from the nginx team, but he's taken that under his umbrella and they did a review of the um what they were planning to release and they didn't really think there was enough there to make it compelling for the community. So it's being re-examined and they're building a bigger team around it now. So it's it's.

F

uh Unfortunately, that just means delays um at this point so but I'll keep you guys posted as as I get new information on when we're gonna uh turn that repo to open source.

A

Awesome, thank you Dylan for tracking that down for us yeah.

F

No problem all.

A

Right folks, um I think the next one next community meeting I think lands on kubecon. We, if I'm not mistaken, um so we'll, probably cancel that one, um because we are presenting on Friday with our community updates uh with where we're at in our plans. So um I can drop. The um I'll drop, the presentation in the Ingress Dev again I started working on a little bit more. It's got some of the survey results in there I'm gonna.

A

Also, we can post the non-pii results of the survey so that folks can have the raw data, um so that link will be in the presentation. If there's anything, you want to make sure that we do discuss at the coupon talk. Please add comments and notes in the presentation and.

D

A

There's any issues or anything you guys know how to reach us.

F

On that note, um as far as how to reach people when we're live at kubecon, what's the best way to go about doing that with you guys uh I'm trying to track you down IRL.

A

Yeah just hit it just hit us up in slack. Okay,.

F

Slack all right we'll do.

E

Hey Dylan, um just curious um I asked last time. If the engineers team is aware about the performance or or reloading problems, when the volume of config is really large, uh they have thought about it or they are aware of it. Is it on their roadmap or.

F

So that's it! That's I I have those two issues she sent to me and I was looking for a home for them and I literally just found it this morning. So that's what I was distracted by talking to Brian who's, the who's, the uh he's the lead PM for for nginx Ingress inside the company, so I I will um I will bring. He specifically asked me to bring those issues to his attention. Out of the blue and I was like.

F

Oh hey, I have two things for you, so yeah I I found a home for him. I don't have an answer for you so got.

D

A

D

A

You Dylan for helping with that all right. Folks, um if I don't hear from you, do I talk to you and I will uh we'll see you in Slack.

F

D

Thanks yeah definitely bye.